Braze SPF and DKIM setup

What you are setting up

Braze is a customer-engagement platform, and its email channel rides on a separate email service provider: SendGrid, SparkPost, or Amazon SES, depending on your contract. That is why there is no include:braze.com and no braze._domainkey selector to look up. The records you publish are the underlying provider's, generated inside the Braze dashboard, and every one of them lives on a dedicated sending subdomain such as mail.example.com. Braze's wording is that the sending domain “must be subordinate to a domain you own,” so your From addresses become @mail.example.com, and SPF, DKIM, and the Return-Path all sit under that subdomain. Your apex zone gets exactly one Braze-related record: DMARC, which Braze leaves to you.

Publish SPF and DKIM

In Braze, go to Settings > Email Self Serve (under Company Settings; you need the Edit Domain Settings permission), select Start setup, enter your sending subdomain, and select Submit. Braze lists the TXT and CNAME records for your provider at the bottom of the page. Add them at your DNS host, come back, and select Verify. Repeat for the tracking domain, which gets its own CNAMEs. Braze also generates an A record so your dedicated IP resolves back to the sending subdomain; add it and select Set up rDNS. The hostnames below are Braze's own examples for mail.example.com; yours will carry your account's identifiers. On SendGrid-backed accounts the shape is:

Type:  CNAME   (Return-Path, carries SPF)
Host:  em.mail
Value: u123456.wl.sendgrid.net

Type:  CNAME   (DKIM key 1)
Host:  s1._domainkey.mail
Value: s1.domainkey.u123456.wl.sendgrid.net

Type:  CNAME   (DKIM key 2)
Host:  s2._domainkey.mail
Value: s2.domainkey.u123456.wl.sendgrid.net

Type:  CNAME   (Click tracking)
Host:  email.mail
Value: sendgrid.net

On SparkPost-backed accounts:

Type:  CNAME   (Return-Path, carries SPF)
Host:  mail
Value: smtp.sparkpostmail.com

Type:  TXT     (DKIM)
Host:  scph1226._domainkey.mail
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFA... (from the Braze dashboard)

Type:  CNAME   (Click tracking)
Host:  click.mail
Value: spgo.io

Every host above is relative to example.com; if your DNS host wants the fully qualified name, it is s1._domainkey.mail.example.com, not s1._domainkey.mail.example.com.example.com. There is no SPF TXT to write by hand on either provider: the return-path CNAME delegates the SPF lookup to SendGrid or SparkPost, who keep the IP list current. Amazon SES accounts are the exception, with three sel1, sel2, sel3 Easy DKIM CNAMEs plus an MX and an SPF TXT on a bounce subdomain; our Amazon SES guide covers those records, and SES is also the only provider for which Braze's Verified Domains option can manage the DNS on your behalf. The scph1226 selector is an example; use whatever selector the dashboard prints, and do not touch the value, which Braze describes as the exact public key string.

Add DMARC

Braze publishes SPF and DKIM through the records above but leaves DMARC to you, and it belongs at the root domain, where it covers mail.example.com and every other subdomain. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Braze's own guidance is that p=none satisfies the Gmail and Yahoo bulk-sender minimum. Because your From is @mail.example.com, the DKIM d= and the Return-Path domain are both on that same subdomain, so alignment holds under DMARC's default relaxed mode with the record at the root. If you later set sp=reject for subdomains, Braze mail keeps passing because it is aligned, but confirm that in the reports first. Build the record with our DMARC builder and progress past p=none once your reports are clean.

The Braze gotcha

You are configuring SendGrid or SparkPost, not Braze. Which one is decided when Braze onboarding provisions your IP pools, and the record set differs: two rotating DKIM CNAMEs on SendGrid versus a single raw DKIM TXT key on SparkPost, and an em return-path host on SendGrid versus a CNAME on the sending subdomain itself on SparkPost. If you inherit a Braze account and cannot tell which you are on, the Return-Path in any delivered message names it (wl.sendgrid.net or sparkpostmail.com). The division of labor trips people up too: Braze generates the records and Braze's ESP holds the keys, but your team publishes and verifies them, and Braze's authentication page is explicit that beyond adding the records you are given there is nothing else to do. Adding include:sendgrid.net or include:_spf.sparkpostmail.com to your apex SPF record does nothing for Braze mail, because no Braze message uses your apex as its Return-Path. It only spends a lookup.

The subdomain is not optional. Braze will not let you send as @example.com; the sending domain must be a subdomain, which means the From address your recipients see changes if you are migrating from a tool that sent from the apex. Plan the switch, and give the subdomain its own DMARC-aware review: in your aggregate reports Braze appears under mail.example.com, not under the root, so a subdomain view is where you confirm it is aligned. On SparkPost, note that the return-path CNAME sits at mail.example.com itself, and a CNAME cannot share a name with any other record, so nothing else can live at that exact host.

Confirm it worked

• Check Email Self Serve. The sending domain, the tracking domain, and the rDNS step should each show as verified. A record that will not verify is almost always the DNS host appending your domain to a host that already includes mail.
• Send a test and read the headers. Send a campaign to yourself, open the message, and confirm the DKIM signature shows d=mail.example.com with s=s1 or s=s2 (SendGrid) or the scph selector (SparkPost), the Return-Path is on your subdomain, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Braze mail shows up in your DMARC aggregate reports as SendGrid or SparkPost infrastructure sending for mail.example.com, aligned and passing on both SPF and DKIM. trustyourinbox labels the source accordingly.